{"answers":{"affected":"1 open source package ship an affected version, including thrift.","exploited":"There is no known exploitation of CVE-2026-85088 in the wild and no public exploit code.","fix":"Upgrade thrift to 0.25.0 or later.","what":"CVE-2026-85088 is a medium-severity vulnerability in Apache Thrift, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-85088 and fix it if it is affected.\n\nWhat it is: CVE-2026-85088 is a medium-severity vulnerability in Apache Thrift, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-85088 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- thrift (Bitnami): affected all versions; fixed in 0.25.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-85088/ (Markdown: https://insights.sbomify.com/CVE-2026-85088/index.md)","id":"CVE-2026-85088","markdown":"https://insights.sbomify.com/CVE-2026-85088/index.md","name":"CVE-2026-85088","record":{"aliases":["AZL-106548","BIT-thrift-2026-85088","DEBIAN-CVE-2026-85088","ECHO-b211-92e6-3d9d","GHSA-4xmj-xwhr-jcj2","MINI-f29v-g78v-34m8","UBUNTU-CVE-2026-85088"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Apache Thrift C++/D library","requires_auth":"none","summary":"Attackers with a valid CA-signed certificate can bypass hostname verification in Apache Thrift C++ and D clients by exploiting Common Name fallback logic.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","version":"4.0"},"cwes":[{"id":"CWE-297","name":"Improper Validation of Certificate with Host Mismatch"},{"id":"CWE-295","name":"Improper Certificate Validation"}],"description":"Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift.\n\nBoth libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the host\n\nname that was connected to. That comparison walks the subjectAltName dNSName entries first and consults the certificate Common Name afterwards. A name that does not match yields a \"skip\" result rather than\n\na rejection, so a certificate whose subjectAltName entries are all present and all non-matching falls through to the Common Name, which can then satisfy the check.\n\nRFC 6125 section 6.4.4, and RFC 9525 section 2, require that the Common Name is not consulted when a dNSName subjectAltName is present. A certificate carrying subjectAltName entries for one name and a\n\nCommon Name for another is therefore accepted for a connection to the second name.\n\nExploitation requires an attacker positioned on the network path who holds a certificate that chains to a certificate authority in the client's trust store and whose Common Name matches the connected host\n\nname. Public certificate authorities have not issued on Common Name alone for many years, so this is principally a concern for deployments using a private or enterprise public-key infrastructure.\n\nThis issue affects the C++ library of Apache Thrift from 0.7.0 through 0.24.0 and the D library from 0.9.0 through 0.24.0. Users should upgrade to 0.25.0.","ecosystems":["Bitnami"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Security feature bypass in Apache Thrift","id":"CVE-2026-85088","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":1,"n_references":2,"next":{"headline":"FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory","id":"CVE-2026-85089"},"packages":[{"ecosystem":"Bitnami","fixed":["0.25.0"],"introduced":["0"],"last_affected":[],"package":"thrift","purl":"pkg:bitnami/thrift","source":"BIT-thrift-2026-85088"}],"prev":{"headline":"Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op","id":"CVE-2026-85087"},"products":["Apache Thrift"],"published":"2026-10-02","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-02","vendors":["Apache Software Foundation"]},"summary":"Attackers with a valid CA-signed certificate can bypass hostname verification in Apache Thrift C++ and D clients by exploiting Common Name fallback logic.","url":"https://insights.sbomify.com/CVE-2026-85088/"}